fiptcha 0.1.0

package/src/captcha-local-solver.js

@@ -0,0 +1,168 @@
+const { captchaModelManager } = require('./captcha-model-manager');
+const { solveImageGrid, PROVIDERS } = require('./captcha-grid-solver');
+
+const TOKEN_SELECTORS = Object.freeze({
+    recaptcha_v2: ['#g-recaptcha-response', 'textarea[name="g-recaptcha-response"]'],
+    hcaptcha: ['textarea[name="h-captcha-response"]', 'textarea[name="g-recaptcha-response"]'],
+    turnstile: ['input[name="cf-turnstile-response"]', 'textarea[name="cf-turnstile-response"]']
+});
+
+async function readToken(page, captchaType) {
+    return page.evaluate(({ type, selectors }) => {
+        for (const selector of selectors[type] || []) {
+            for (const element of document.querySelectorAll(selector)) {
+                const value = String(element.value || element.getAttribute('value') || '').trim();
+                if (value) return value;
+            }
+        }
+        if (type === 'recaptcha_v2' && globalThis.grecaptcha?.getResponse) {
+            try { return globalThis.grecaptcha.getResponse() || ''; } catch { /* widget id may be required */ }
+        }
+        if (type === 'hcaptcha' && globalThis.hcaptcha?.getResponse) {
+            try { return globalThis.hcaptcha.getResponse() || ''; } catch { /* widget id may be required */ }
+        }
+        if (type === 'turnstile' && globalThis.turnstile?.getResponse) {
+            try { return globalThis.turnstile.getResponse() || ''; } catch { /* widget id may be required */ }
+        }
+        return '';
+    }, { type: captchaType, selectors: TOKEN_SELECTORS }).catch(() => '');
+}
+
+async function waitForToken(page, captchaType, timeout) {
+    const deadline = Date.now() + Math.max(0, timeout);
+    do {
+        const token = await readToken(page, captchaType);
+        if (token) return token;
+        if (Date.now() >= deadline) break;
+        await page.waitForTimeout(Math.min(150, Math.max(1, deadline - Date.now())));
+    } while (Date.now() <= deadline);
+    return null;
+}
+
+async function waitForTokenOrChallenge(page, captchaType, timeout) {
+    const adapter = PROVIDERS[captchaType];
+    const deadline = Date.now() + Math.max(0, timeout);
+    do {
+        const token = await readToken(page, captchaType);
+        if (token) return token;
+        if (adapter) {
+            for (const frame of page.frames?.() || []) {
+                if (!adapter.framePatterns.some((pattern) => frame.url().includes(pattern))) continue;
+                if (await frame.locator(adapter.grid).first().isVisible({ timeout: 100 }).catch(() => false)) return null;
+            }
+        }
+        if (Date.now() >= deadline) break;
+        await page.waitForTimeout(Math.min(150, Math.max(1, deadline - Date.now())));
+    } while (Date.now() <= deadline);
+    return null;
+}
+
+async function clickCheckbox(page, captchaType) {
+    const patterns = captchaType === 'hcaptcha'
+        ? ['hcaptcha.com/captcha', 'newassets.hcaptcha.com/captcha']
+        : captchaType === 'turnstile'
+            ? ['challenges.cloudflare.com']
+            : ['/recaptcha/api2/anchor', '/recaptcha/enterprise/anchor'];
+    const selector = captchaType === 'hcaptcha'
+        ? '#checkbox, [role="checkbox"], input[type="checkbox"], label'
+        : captchaType === 'turnstile'
+            ? 'input[type="checkbox"], [role="checkbox"], button, label'
+            : '#recaptcha-anchor, [role="checkbox"]';
+    for (const frame of page.frames?.() || []) {
+        if (!patterns.some((pattern) => frame.url().includes(pattern))) continue;
+        const checkbox = frame.locator(selector).first();
+        if (!await checkbox.isVisible({ timeout: 1000 }).catch(() => false)) continue;
+        if (!await checkbox.isEnabled({ timeout: 250 }).catch(() => true)) continue;
+        const pointerReady = await checkbox.evaluate((element) => {
+            const style = getComputedStyle(element);
+            return style.pointerEvents !== 'none' && element.getAttribute('aria-disabled') !== 'true';
+        }).catch(() => true);
+        if (!pointerReady) continue;
+        const firstBox = await checkbox.boundingBox().catch(() => null);
+        await page.waitForTimeout(75);
+        const box = await checkbox.boundingBox().catch(() => null);
+        if (firstBox && box && (Math.abs(firstBox.x - box.x) >= 1 || Math.abs(firstBox.y - box.y) >= 1)) continue;
+        if (box && page.mouse) {
+            const x = box.x + box.width / 2;
+            const y = box.y + box.height / 2;
+            await page.mouse.move(x, y, { steps: 8 });
+            await page.mouse.down();
+            await page.waitForTimeout(45);
+            await page.mouse.up();
+        } else {
+            await checkbox.click({ timeout: 2000 });
+        }
+        return true;
+    }
+    return false;
+}
+
+async function executeHcaptchaWidget(page) {
+    return page.evaluate(() => {
+        if (typeof globalThis.hcaptcha?.execute !== 'function') return false;
+        try {
+            const pending = globalThis.hcaptcha.execute();
+            if (pending && typeof pending.catch === 'function') pending.catch(() => {});
+            return true;
+        } catch {
+            return false;
+        }
+    }).catch(() => false);
+}
+
+async function solveLocalCaptcha(page, { captchaType, timeout = 60_000, logs = [] } = {}) {
+    if (!['recaptcha_v2', 'hcaptcha', 'turnstile'].includes(captchaType)) {
+        throw new Error(`Local solver does not support ${captchaType}`);
+    }
+    const deadline = Date.now() + Math.max(1, timeout);
+    let usedVisionModel = false;
+    const modelReadiness = ['recaptcha_v2', 'hcaptcha'].includes(captchaType)
+        ? captchaModelManager.reconcile().then((runtime) => ({ runtime }), (error) => ({ error }))
+        : null;
+    let token = await readToken(page, captchaType);
+    if (!token) {
+        await clickCheckbox(page, captchaType).catch((error) => logs.push(`Local ${captchaType} checkbox click failed: ${error.message}`));
+        const initialWait = captchaType === 'hcaptcha' ? 1500 : 7000;
+        token = await waitForTokenOrChallenge(page, captchaType, Math.min(initialWait, Math.max(0, deadline - Date.now())));
+        if (!token && captchaType === 'hcaptcha' && Date.now() < deadline) {
+            const executed = await executeHcaptchaWidget(page);
+            if (executed) logs.push('Local hcaptcha widget required programmatic execution after checkbox interaction');
+            token = await waitForTokenOrChallenge(page, captchaType, Math.min(5500, Math.max(0, deadline - Date.now())));
+        }
+    }
+    if (!token && captchaType === 'turnstile') {
+        throw new Error('Turnstile did not issue a token after the active-browser interaction');
+    }
+    if (!token) {
+        const adapter = PROVIDERS[captchaType];
+        const frameDeadline = Math.min(deadline, Date.now() + 4000);
+        let challengeVisible = false;
+        while (!challengeVisible && Date.now() < frameDeadline) {
+            for (const frame of page.frames?.() || []) {
+                if (!adapter.framePatterns.some((pattern) => frame.url().includes(pattern))) continue;
+                challengeVisible = await frame.locator(adapter.grid).first().isVisible({ timeout: 100 }).catch(() => false);
+                if (challengeVisible) break;
+            }
+            if (!challengeVisible) await page.waitForTimeout(100);
+        }
+        if (!challengeVisible) throw new Error(`${captchaType} did not expose an image challenge or token`);
+        if (modelReadiness) {
+            const readiness = await modelReadiness;
+            if (readiness.error) throw new Error(`vision backend unavailable: ${readiness.error.message}`);
+            if (!readiness.runtime) throw new Error(captchaModelManager.status().error || 'vision backend unavailable');
+        }
+        usedVisionModel = true;
+        logs.push(`Local ${captchaType} image challenge is ready; starting grid solver`);
+        token = await solveImageGrid(page, { captchaType, deadline, waitForToken, logs });
+    }
+    if (!token) throw new Error(`${captchaType} challenge ended without producing a token`);
+    const status = captchaModelManager.status();
+    return {
+        token,
+        provider: 'local',
+        ...(usedVisionModel && status.activeTier ? { model: status.activeTier } : {}),
+        device: usedVisionModel ? (status.device || 'cpu') : 'browser'
+    };
+}
+
+module.exports = { TOKEN_SELECTORS, readToken, waitForToken, waitForTokenOrChallenge, clickCheckbox, executeHcaptchaWidget, solveLocalCaptcha };

package/src/captcha-mlx-runtime.js

@@ -0,0 +1,140 @@
+const fs = require('fs');
+const path = require('path');
+const { spawn } = require('child_process');
+const readline = require('readline');
+const { APPLE_MLX_MANIFEST } = require('./captcha-model-manifest');
+const { downloadModelArtifacts, verifyArtifactDirectory } = require('./captcha-model-downloader');
+
+const PROBE_PNG = Buffer.from(
+    'iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAIAAAD8GO2jAAAAGUlEQVR4nO3BAQ0AAADCoPdPbQ43oAAAAAAAAAB4Gx4gAAE7Bq0AAAAASUVORK5CYII=',
+    'base64'
+);
+
+class MlxFlorenceRuntime {
+    constructor(processHandle) {
+        this.process = processHandle;
+        this.pending = new Map();
+        this.nextId = 1;
+        this.closed = false;
+    }
+
+    static async create(modelDir, timeout = 60_000) {
+        const python = path.resolve(process.cwd(), 'data', 'captcha-companion', 'venv', 'bin', 'python3');
+        const worker = path.resolve(__dirname, '..', 'scripts', 'captcha-mlx-worker.py');
+        if (!fs.existsSync(python)) throw new Error('Pinned MLX environment is not installed; run npm run companion:install');
+        const child = spawn(python, [worker, modelDir], {
+            stdio: ['pipe', 'pipe', 'pipe'],
+            env: { ...process.env, HF_HUB_OFFLINE: '1', TRANSFORMERS_OFFLINE: '1', PYTHONUNBUFFERED: '1' }
+        });
+        const runtime = new MlxFlorenceRuntime(child);
+        const ready = new Promise((resolve, reject) => {
+            runtime.readyResolve = resolve;
+            runtime.readyReject = reject;
+        });
+        readline.createInterface({ input: child.stdout }).on('line', (line) => runtime._handleLine(line));
+        child.stderr.on('data', (chunk) => {
+            const message = chunk.toString().trim();
+            if (message) runtime.lastDiagnostic = message.slice(-1000);
+        });
+        child.once('error', (error) => runtime._close(error));
+        child.once('exit', (code, signal) => runtime._close(new Error(`MLX worker exited (${signal || code})${runtime.lastDiagnostic ? `: ${runtime.lastDiagnostic}` : ''}`)));
+        const timer = setTimeout(() => runtime.readyReject?.(new Error('MLX worker startup timed out')), timeout);
+        timer.unref?.();
+        try {
+            await ready;
+            clearTimeout(timer);
+            return runtime;
+        } catch (error) {
+            clearTimeout(timer);
+            await runtime.dispose();
+            throw error;
+        }
+    }
+
+    _handleLine(line) {
+        let payload;
+        try { payload = JSON.parse(line); } catch { return; }
+        if (Object.prototype.hasOwnProperty.call(payload, 'ready')) {
+            if (payload.ready) this.readyResolve?.(payload);
+            else this.readyReject?.(new Error(payload.error || 'MLX worker failed to load'));
+            this.readyResolve = null;
+            this.readyReject = null;
+            return;
+        }
+        const pending = this.pending.get(payload.id);
+        if (!pending) return;
+        this.pending.delete(payload.id);
+        clearTimeout(pending.timer);
+        if (payload.error) pending.reject(new Error(payload.error));
+        else if (!Array.isArray(payload.detections)) pending.reject(new Error('MLX worker returned invalid detections'));
+        else pending.resolve(payload.detections);
+    }
+
+    _close(error) {
+        if (this.closed) return;
+        this.closed = true;
+        this.readyReject?.(error);
+        for (const pending of this.pending.values()) {
+            clearTimeout(pending.timer);
+            pending.reject(error);
+        }
+        this.pending.clear();
+    }
+
+    async detect(imageBuffer, label, threshold = APPLE_MLX_MANIFEST.threshold, timeout = 45_000) {
+        if (this.closed) throw new Error('MLX worker is not running');
+        const id = this.nextId++;
+        const result = new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                reject(new Error('MLX inference timed out'));
+            }, timeout);
+            timer.unref?.();
+            this.pending.set(id, { resolve, reject, timer });
+        });
+        this.process.stdin.write(`${JSON.stringify({ id, label, threshold, imageBase64: imageBuffer.toString('base64') })}\n`);
+        return result;
+    }
+
+    async probe() {
+        await this.detect(PROBE_PNG, 'object', 0.99, 30_000);
+    }
+
+    async dispose() {
+        if (!this.closed) this.process.kill('SIGTERM');
+        this._close(new Error('MLX worker stopped'));
+    }
+}
+
+async function loadVerifiedMlxRuntime(modelRoot, options = {}) {
+    const staging = path.join(modelRoot, '.staging-florence2-mlx');
+    const target = path.join(modelRoot, 'florence2-mlx');
+    await fs.promises.rm(staging, { recursive: true, force: true });
+    let verified = await verifyArtifactDirectory('florence2_mlx', target, { manifest: APPLE_MLX_MANIFEST }).catch(() => false);
+    if (!verified) {
+        await fs.promises.rm(target, { recursive: true, force: true });
+        await fs.promises.mkdir(staging, { recursive: true });
+        try {
+            await downloadModelArtifacts('florence2_mlx', staging, { manifest: APPLE_MLX_MANIFEST, fetchImpl: options.fetchImpl });
+            verified = await verifyArtifactDirectory('florence2_mlx', staging, { manifest: APPLE_MLX_MANIFEST });
+            if (!verified) throw new Error('MLX Florence artifact verification failed');
+            await fs.promises.rename(staging, target);
+        } catch (error) {
+            await fs.promises.rm(staging, { recursive: true, force: true });
+            throw error;
+        }
+    }
+    let runtime;
+    try {
+        runtime = await MlxFlorenceRuntime.create(target);
+        await runtime.probe();
+        return runtime;
+    } catch (error) {
+        await runtime?.dispose?.().catch?.(() => undefined);
+        await fs.promises.rm(staging, { recursive: true, force: true });
+        await fs.promises.rm(target, { recursive: true, force: true });
+        throw error;
+    }
+}
+
+module.exports = { MlxFlorenceRuntime, loadVerifiedMlxRuntime };

package/src/captcha-model-downloader.js

@@ -0,0 +1,162 @@
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const { Readable } = require('stream');
+const { pipeline } = require('stream/promises');
+const { MODEL_MANIFESTS } = require('./captcha-model-manifest');
+
+const APPROVED_DOWNLOAD_HOSTS = Object.freeze([
+    'huggingface.co',
+    'hf.co',
+    'xethub.hf.co'
+]);
+
+function isApprovedDownloadUrl(rawUrl) {
+    let hostname;
+    try {
+        const url = new URL(rawUrl);
+        if (url.protocol !== 'https:') return false;
+        hostname = url.hostname.toLowerCase();
+    } catch {
+        return false;
+    }
+    return APPROVED_DOWNLOAD_HOSTS.some((allowed) => hostname === allowed || hostname.endsWith(`.${allowed}`));
+}
+
+function safeArtifactPath(root, relativePath) {
+    if (!relativePath || path.isAbsolute(relativePath) || relativePath.includes('..')) {
+        throw new Error(`Unsafe CAPTCHA model artifact path: ${relativePath}`);
+    }
+    const resolvedRoot = path.resolve(root);
+    const resolved = path.resolve(root, relativePath);
+    if (!resolved.startsWith(`${resolvedRoot}${path.sep}`)) throw new Error(`Artifact escapes model root: ${relativePath}`);
+    return resolved;
+}
+
+async function checksumFile(filePath) {
+    const hash = crypto.createHash('sha256');
+    const input = fs.createReadStream(filePath);
+    for await (const chunk of input) hash.update(chunk);
+    return hash.digest('hex');
+}
+
+async function fetchWithApprovedRedirects(url, options = {}, maxRedirects = 5) {
+    let current = url;
+    for (let redirect = 0; redirect <= maxRedirects; redirect += 1) {
+        if (!isApprovedDownloadUrl(current)) throw new Error(`Blocked model download redirect to unapproved host: ${current}`);
+        const response = await fetch(current, { ...options, redirect: 'manual' });
+        if (![301, 302, 303, 307, 308].includes(response.status)) return response;
+        const location = response.headers.get('location');
+        if (!location) throw new Error('Model download redirect omitted Location header');
+        current = new URL(location, current).toString();
+    }
+    throw new Error('Model download exceeded redirect limit');
+}
+
+async function verifyArtifact(filePath, expected) {
+    const stat = await fs.promises.stat(filePath).catch(() => null);
+    if (!stat?.isFile() || stat.size !== expected.size) return false;
+    return await checksumFile(filePath) === expected.sha256;
+}
+
+async function downloadArtifact(manifest, artifact, root, fetchImpl = fetchWithApprovedRedirects) {
+    const target = safeArtifactPath(root, artifact.path);
+    if (await verifyArtifact(target, artifact)) return target;
+    await fs.promises.mkdir(path.dirname(target), { recursive: true });
+    const partial = `${target}.part`;
+    await fs.promises.rm(partial, { force: true });
+    const encodedPath = artifact.path.split('/').map(encodeURIComponent).join('/');
+    const url = `https://huggingface.co/${manifest.id}/resolve/${manifest.revision}/${encodedPath}`;
+    const response = await fetchImpl(url, {
+        headers: { 'Accept-Encoding': 'identity' },
+        signal: AbortSignal.timeout(10 * 60_000)
+    });
+    if (!response.ok || !response.body) throw new Error(`Model download failed for ${artifact.path}: HTTP ${response.status}`);
+    const declaredLength = Number(response.headers.get('content-length'));
+    const contentEncoding = response.headers.get('content-encoding');
+    if ((!contentEncoding || contentEncoding === 'identity') && Number.isFinite(declaredLength) && declaredLength !== artifact.size) {
+        throw new Error(`Model artifact size header mismatch for ${artifact.path}`);
+    }
+    const hash = crypto.createHash('sha256');
+    let received = 0;
+    const verifier = new (require('stream').Transform)({
+        transform(chunk, _encoding, callback) {
+            received += chunk.length;
+            hash.update(chunk);
+            callback(null, chunk);
+        }
+    });
+    try {
+        await pipeline(Readable.fromWeb(response.body), verifier, fs.createWriteStream(partial, { flags: 'wx', mode: 0o600 }));
+        const digest = hash.digest('hex');
+        if (received !== artifact.size || digest !== artifact.sha256) {
+            throw new Error(`Model artifact checksum mismatch for ${artifact.path} (received ${received} bytes, sha256 ${digest})`);
+        }
+        await fs.promises.rename(partial, target);
+        return target;
+    } catch (error) {
+        await fs.promises.rm(partial, { force: true }).catch(() => undefined);
+        throw error;
+    }
+}
+
+async function listFiles(root, current = root) {
+    const entries = await fs.promises.readdir(current, { withFileTypes: true }).catch(() => []);
+    const files = [];
+    for (const entry of entries) {
+        const fullPath = path.join(current, entry.name);
+        if (entry.isDirectory()) files.push(...await listFiles(root, fullPath));
+        else files.push(path.relative(root, fullPath));
+    }
+    return files.sort();
+}
+
+async function verifyArtifactDirectory(tier, root, { rejectUnlisted = true, manifest: manifestOverride } = {}) {
+    const manifest = manifestOverride || MODEL_MANIFESTS[tier];
+    if (!manifest) throw new Error(`Unknown CAPTCHA model tier: ${tier}`);
+    for (const artifact of manifest.files) {
+        if (!await verifyArtifact(safeArtifactPath(root, artifact.path), artifact)) return false;
+    }
+    if (rejectUnlisted) {
+        const allowed = new Set(manifest.files.map((artifact) => artifact.path));
+        const actual = await listFiles(root);
+        const unexpected = actual.filter((file) => !allowed.has(file));
+        if (unexpected.length) throw new Error(`Unlisted CAPTCHA model artifact: ${unexpected[0]}`);
+    }
+    return true;
+}
+
+async function downloadModelArtifacts(tier, root, options = {}) {
+    const manifest = options.manifest || MODEL_MANIFESTS[tier];
+    if (!manifest) throw new Error(`Unknown CAPTCHA model tier: ${tier}`);
+    await fs.promises.mkdir(root, { recursive: true });
+    const maxAttempts = Math.max(1, Number(options.maxAttempts) || 3);
+    for (const artifact of manifest.files) {
+        let lastError;
+        for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+            try {
+                await downloadArtifact(manifest, artifact, root, options.fetchImpl);
+                lastError = null;
+                break;
+            } catch (error) {
+                lastError = error;
+                if (attempt < maxAttempts) await new Promise((resolve) => setTimeout(resolve, attempt * 250));
+            }
+        }
+        if (lastError) throw lastError;
+    }
+    if (!await verifyArtifactDirectory(tier, root, { manifest })) throw new Error(`CAPTCHA model verification failed for ${tier}`);
+    return manifest;
+}
+
+module.exports = {
+    APPROVED_DOWNLOAD_HOSTS,
+    isApprovedDownloadUrl,
+    safeArtifactPath,
+    checksumFile,
+    fetchWithApprovedRedirects,
+    verifyArtifact,
+    verifyArtifactDirectory,
+    downloadArtifact,
+    downloadModelArtifacts
+};